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O-i Abstract. We propose an improved two-way continuous- variable quantum key 

distribution (CV QKD) protocol by adding proper random noise on the receiver's 
homodyne detection, the security of which is analysed against general collective attacks. 
^ | The simulation result under the collective entangling doner attack indicates that the 

O"* correlation between two-way channels decreases the secret key rate relative to the 

uncorrelated channels. Importantly, the added noise in detection is beneficial for the 
secret key rate and the tolerable excess noise of this two-way protocol. With the 
■ reasonable reconciliation efficiency of 90%, the two-way CV QKD with added noise 

\ allows the distribution of secret keys over 60 km fibre distance. 
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1. Introduction 

Quantum key distribution can enable two authentic parties, the sender (Alice) and the 
receiver (Bob), to obtain unconditional secret keys without restricting the power of the 
eavesdropper (Eve) [U [2]. On the premise of unconditional security, the higher key 
rate and the longer distance are constantly pursued [31 H]. To enhance the tolerable 
excess noise of the continuous- variable quantum key distribution (CV QKD) [HUB], the 
two-way CV QKD protocols are proposed [TJ [8] , where Bob initially sends a mode to 
Alice, and Alice encodes her information by applying a random displacement operator 
to the received mode and then sends it back to Bob. Bob detects both his original 
mode and received mode to decode Alice's modulations. Although the two-way CV 
QKD protocols can remarkably enhance the tolerable excess noise [U E], it needs to 
implement the tomography of the quantum channels to analyze the security under 
general collective attack [7], which is complicated in practice. Therefore, we proposed 
a feasible modified two-way protocol by replacing the displacement operation of the 
original two-way protocol with a passive operation on Alice's side [9]. However, the 
source noise [TUl EH H21 H3J [14] and both detection efficiency and detection noise [T5l [16] 
on Bob's side are not considered in the modified protocol. 

It has been proved that adding a proper noise on Bob's detection side in one-way 
CV QKD can enhance the tolerable excess noise and the secret key rate in reverse 
reconciliation [12j [T7J [HJ [19j [201 EI]- This idea has been applied to the original two- 
way protocol in [22] , while the scheme did not consider the correlation between the two 
channels. The correlated noise affects the secret key rate [231 121] • In this paper, we 
apply the idea of adding noise to our modified two-way protocol Hom|/|- [9] to enhance 
the tolerable excess noise and the secret key rate. Considering the correlation between 
the channels, the security of the two-way CV QKD with added noise against entangling 
doner collective attacks [251 126] is analysed and numerically simulated. 

2. The two-way CV QKD with added noise in homodyne detection 

The entanglement-based (EB) scheme of the two-way CV-QKD protocol Hom^ with 
added detection noise is shown in Figure Q^a), where the dashed box at B 2 is the added 
noise and the other part is our original two-way protocol Hom^j [9]. The added noise is 
equivalent to an EPR pair with the variance of Vjy coupled into the channel by a beam 
splitter with the transmittance of Tjv- The protocol Hom^ is described as follows. 

Step one. Bob initially keeps one mode Bi of an EPR pair with the variance of V 
while sending the other mode C\ to Alice through the forward channel. 

Step two. Alice measures one mode A\ of her EPR pair (variance: Va) to get the 
variables {xa 1x , Pa 1p } with a heterodyne detection, and couples the other mode of her 
EPR pair with the received mode A{ n from Bob by a beam splitter (transmittance: Ta). 
One output mode A 2 of the beam splitter is measured with homodyne detection and 
the other output mode A out is sent back to Bob through the backward channel. 
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Figure 1. (a) The EB scheme of Hom^ protocol. Bob keeps one half of the EPR pair 
(EPR) and sends the other half to Alice. Alice measures one mode of her EPR pair 
(EPR') and one mode Ai from a beam splitter Ta- The other mode from this beam 
splitter is returned back to Bob. The letters (e.g. Bi) beside arrows: the mode at 
the arrow; E: Eve's whole mode; the dashed box at A\: the heterodyne detection; the 
dashed box at B^: the added noise, (b) The equivalent scheme to Figured] (a) with 
postprocessing. Bob uses a symplectic transformation Tk to change the modes Bi and 
B\ into B$ and B4. 



Step three. With a beam splitter (transmittance: Tjv), Bob couples another EPR 
pair (variance: Vjv) which is equivalent to the added noise with his received mode. 
The two modes Ni and N 2 of this EPR pair are measured. Bob performs homodyne 
detections on both modes Bi and B 2 to get the variables xb 1 (or p Bl ) and xb 2 (or Pb 2 ), 
respectively. 

Step four. Alice and Bob implement the reconciliation and privacy amplification 
[271 128] - In this step, the measurement values of the modes B 2 , B 1 , A 2 , Ax, N 2 and 
Ni are used to estimate the channel's parameters and Bob uses xb = %b 2 ~ kxs 1 
(j>B = PB 2 + kps 1 ) to construct the optimal estimation to Alice's corresponding variables 
%A 1X (pa 1p ), where k is the channel's total transmittance. 

The prepare-and-measure (PM) scheme of the two-way protocol can be equivalent to 
the EB scheme. In fact, Alice heterodyning one half of the EPR pair at A\ is equivalent 
to remotely preparing a coherent state, and Bob performing homodyne detection on one 
half of the EPR pair at Bi is equivalent to remotely preparing a squeezed state |25j. 
The homodyne detection preceded by an EPR pair coupled by a beam splitter at B 2 
is equivalent to Bob's real homodyne detection with efficiency T/v and electronic noise 
[TT] . Note that x and p quadratures are randomly measured in homodyne detection and 
only x quadrature is analysed in the following. 

3. The analysis of the security against general collective attack 

First, we show that the Gaussian attack is optimal to the two-way protocol Hom^ in 
general collective attack. In Figure Ufa), since all modes of Alice and Bob are measured, 
Eve can get the purification of the state of Alice and Bob. In addition, the x and 
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p quadratures of Alice and Bob's modes are not mixed via heterodyne or homodyne 
detection and Alice and Bob use the second-order moments of the quadratures to bound 
Eve's information. Therefore, the two-way protocol Hom^ can satisfy the requirement of 
optimality of Gaussian collective attack (i.e., continuity, invariance under local Gaussian 
unitary and strong subadditivity) [29]. When the corresponding covariance matrix of 
the state B2B1N2N1A2A1 is known for Alice and Bob, the Gaussian attack is optimal 
[30| |3T| |32| 133] . Therefore, only Eve's Gaussian collective attack is needed to be 
considered in the following security analysis. 

In Figure Ufa), the secret key rate of the two-way protocol Hom^j- in reverse 
reconciliation is [TBI EH EH] EE] 

K R = PI(B : A) - I(B : E) 

-S(E) + S(E\x B ), 



1/3 l og Vam 
2 Va m \x b 



(1) 



where /3 is the reconciliation efficiency, I(B : A) [I(B : E)] is the mutual information 
between Bob and Alice (Eve), V^m and Vam\ Xb are Alice's variance and conditional 
variance, S(E) and S(E\xb) are Eve's von Neumann entropy and conditional von 
Neumann entropy on Bob's data, respectively. In the following, S(E) and S(E\xb) 
are calculated by the methods in [3~T] . 

For Gaussian state, the entropy can be calculated from its corresponding covariance 
matrix [38]. Since the state B2B1N2N1A2A1E is a pure state, then S(E) = 
S (B2B1N2N1A2A1) . The corresponding covariance matrix of the state B2B1N2N1A2A1 
is 
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where I is a 2 x 2 identity matrix, the diagonal elements correspond to the variances 
of x and p quadratures of the modes B 2 , Bi, N 2 , Ni, A 2 and A\ in turn, e.g. 
7s 2 = diag((x^ 2 ), (p B )), and the nondiagonal elements correspond to the covariances 
between modes, e.g. C\ = diag((xs 2 XB 1 ), (pb 2 Pb 1 ))- Therefore, Eve's entropy [39] 
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and Aj = f\Xc*mn) is the symplectic 
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Bob uses xb 



Appendix A 



xb 2 — kxs 1 to estimate Alice's variable, which is equivalent to that 
Bob uses a symplectic transformation to change the modes B 2 and B\ into the modes 
.84 and B 3 where the x quadrature of the mode B A is ig 4 = xb = %b 2 — kxs x [9], as 
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shown in Figure []Tb). Since Figure [TJb) is equivalent to Figure [TJa) with postprocessing, 
we use Figure [T](b) to calculate S(E\xb) in the following. 

After the symplectic transformation Fk, the corresponding covariance matrix of the 
mode B 4 B 3 N 2 N 1 A 2 A 1 is 

J- B4B3N2N1A2A1 = [T k © h)T B2BlN2NlA2Al [T k © I 4 ] T , (4) 

where I 4 = ffif I, T fc is a continuous- variable C-NOT gate [291 B2 

/ 1 -jfe \ 
10 



10 
\0 k 1 J 



(5) 



Since the state B 3 N 2 NiA 2 AiE is a pure state when Bob gets xb by measuring the 
modes _B 4 , then S(E\xb) = S(B 3 N 2 N 1 A 2 Ai\xb)- The corresponding covariance matrix 
of the state B 3 N 2 N 1 A 2 Ai conditioned on x B is [2"9"| |4"4"] 

r^VaViAaAi = lB 3 N 2 N 1 A 2 A l ~ C Bi [X x ^j Ba X x ] MP C Bi -, (6) 

where ^b 3 n 2 n 1 a 2 a 1 and 7b 4 are the corresponding reduced matrixes of the states 
I^iV^iVi^Ai and B± in V b a b s n 2 NxA^a^ respectively, C*b 4 is their correlation matrix, 
X x = diag(l, 0) and MP denotes the inverse on the range. Therefore, we have 

5 5 

s(e\x b ) = J2 g ^ =E G te(0) > (7) 

i=l i=l 

where A ■ = fy {a' mn ) is the symplectic eigenvalue of ^b^n^A! which is the function of 



the element a' mn of r^ 3 ^ V2A r iA2Ai jlQl E], seen in Appendix A 

By substituting equations (j3J) and ([7]) into equation ((T]), the secret key rate is 
obtained 

K R =U log 2 - (/ Ai (a mn ) ) + E G «n)) • (8) 

In experiment, Alice and Bob can calculate the element a mn and a' mn of equations (J2j) 
and by the measurement values of the modes B 2 , B\, N 2 , A r 1 , A 2 and A\. Therefore, 
according to equation (jSj), the secret key rate in general collective attack is obtained 
without the assumption of channels. The analytic representations of equation (jSJ) is too 
complex to give here. We give a numerical simulation in the following. 



4. Numerical simulation and discussion of collective entangling doner 
attacks on correlated and uncorrelated channels 

For simplicity in numerical simulation, when there is no Eve, the forward and the 
backward channels are assumed to be independent with the identical transmittances T 
and noises referred to the input x = e + (l — T)/T, where e is the channel excess noises 
referred to the input. It is equivalent to Eve implementing two independent collective 
entangling doner attacks which are a Gaussian collective attack investigated in detail 
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Figure 2. The EB scheme of Hom^ protocol against entangling doner attacks on 
correlated channels. E\, E^- the modes introduced into the channels; T^: half beam 
splitter; T c : beam splitter. Alice and Bob are the same as Figure [IJa). 
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Figure 3. (a) Secret key rate as a function of the transmission distance for Hom^ 
protocol, where e = 0.06, /3 = 90%, T A = 0.8, V A = V = 20 and n c = 0,0.5, 1. (b) 
Optimal choice of the added noise Xd- 




Figure 4. (a) Tolerable excess noise as a function of the transmission distance for 
Hom^, Homjyj, Horn and Het protocols, where /3 — 90%. (b) Tolerable excess noise 
as a function of the transmission distance for Hom^, where /? = 100%, 90%, 80%, 70%. 
The curves of (a) and (b) are plotted for n c — 0, Ta = 0.8, and Va = V = 20. 



in jl5l H6]. When Eve implements more complicated two- mode attack, the correlation 
between the two channels is induced. Figure |2] shows that Eve implements two correlated 
entangling doner attacks. On condition that Eve introduces the equivalent variances 
of the modes E% and Ei into the two channels, the noise referred to the input of the 
backward channel is \2 — X + ^cVTaTe, where the second item on the right-hand side 
is induced extra by the correlation between the two channels, i.e., the part of the mode 
introduced into the backward channel correlating with the forward channel interferes 
with the mode from Alice, n c = \J1 — T c is the coefficient representing the degree of the 
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Distance (km) Distance (km) 

Figure 5. (a) Secret key rate as a function of the transmission distance for Hom^, 
Hom|/j, Hom-Het, Horn and Het protocols where n c = 0, e = 0.06, (3 = 90%, T A = 0-8 
and Va — V = 20. (b) Optimal choice of the added noise xd- 



correlation, e.g., n c = represents that the two channels are uncorrelated. The added 
noise is xd = (1 — Tn)Vn /Tn. We can calculate the elements of equation (j2j) 

1b 2 = {V N - T N V N + TT N [V A - T A V A + TT A {V + X ) + X 2 ]}I, 
1n 2 = {T N V N + T(l - T N )[V A - T A V A + TT A (V + X ) + X2 ]}I, 
1A 2 = [T A V A + T( 1-T A )(V + X )% 
Ci = -r]C 6 = Ty/T A T N {V* - l)a z , 



C 2 =^/{l-T N )T N {V N - T[V A - T A V A + TT A (V + X ) + * 2 ]}I, 
C 3 = l -C s = y/(l-T N )(V*-l)a z , 



C 4 = - V C 9 =^T(1-TJT N \Jf~ A V A -T^ A (y + x)~n c y/Te 
C 5 = - V C 10 = y/T(l-T A )T N (V* A -l)<r„ 



C 7 = 



-^T(1-T A )(V 2 

VtaIv 



iy 2 



and 



T 2 T A F + T(V A — T A V A 



lir> , 1, T' Z T A F + T(Va - T A V A + xg) + Xd 
( } 2° g2 T(1-T A + X2 )+T^F + XD • 



(9) 



(10) 



where a z = diag(l, -1), 77= y/T N /(l-T N ), F =2V-2y/V 2 -1+X- The typical fiber channel 
loss is assumed to be 0.2 dB/km. 1/ and e are in shot-noise units. Substituting equations 
(J9j) and ( flOi) into equation (jSJ) , the optimal secret key rate .Kr and the optimal tolerable 
excess noise e of the two-way protocol Hom^ can be obtained by adjusting the added 
noise xd- 

Figure EJ^a) shows the secret key rate as a function of the transmission distance for 
Hom^ protocol with different n c . Considering the practical experiment [151 EES1HT], we 
choose e = 0.06, /3 = 90%, T A = 0.8, V A = V = 20 and n c = 0,0.5, 1. To make K R 
optimal, the proper added noise xd is chosen, as shown in Figure [3^b). In Figure |3]^a), 
the simulation result indicates that the distance of the secret key distribution decreases 
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with the increase of n c , which indicates that the correlation between the channels is 
beneficial for Eve. Figure [3]^b) shows that the optimal added noise decreases with the 
decrease of n c . 

When n c = 0, the two channels are uncorrected, which is equivalent to Eve 
implementing two independent Gaussian doner attacks. For comparison, the heterodyne 
protocol (Het) [H] and the homodyne protocol (Horn) [36] of one-way CV-QKD protocol 
with coherent state and the original modified two-way protocols Hom|/|- and Horn- Het ]y[ 
[9] are also given in figures. H(a) and [5(a). Figure 11(a) shows the tolerable excess noise 
as a function of the transmission distance, where Va = V = 20, Ta = 0.8, (3 = 90% and 
n c = 0. The proper added noise xd is chosen to make e of Hom^j protocol optimal. 
The numerical simulation result indicates that the tolerable excess noise of the two-way 
protocol with added noise is more than that without added noise and surpasses that 
of the one-way CV-QKD protocol. Therefore, it indicates that properly added noise 
is useful to enhance e in the two-way protocol. Figure IU(b) shows the tolerable excess 
noise e of Hom^ protocol with different (3, which indicates that the tolerable excess 
noise e increases with the increase of j3. 

Figure E(a) shows the secret key rate as a function of the transmission distance, 
where V = V A = 20, T A = 0.8, e = 0.06, /3 = 90% and n c = 0. To make the secret key 
rate of Hom^ optimal, the proper added noise xd is chosen, as shown in Figure [5(b). In 
Figure [5(a), the simulation result indicates that the two-way protocol with added noise 
has higher secret key rate than that without added noise. Especially, the achievable 
transmission distance of the two-way protocol Hom^ is over 60 km when (3 is 90%, 
which is much longer than that of the one-way protocol. The reason is that the added 
noise not only lowers the mutual information between Alice and Bob, but also lowers 
that between Bob and Eve. When the effect on Eve is more than that on Alice and 
Bob, the secret key rate is enhanced. 

5. Conclusion 

In conclusion, we improve the two-way CV-QKD protocol by adding a proper noise on 
Bob's detection side. The security of the two-way CV-QKD protocol with added noise 
in homodyne detection against general collective attack is analysed. The numerical 
simulation under the collective entangling doner attack is given for the correlated and 
the uncorrelated channels. The simulation result indicates that the secret key rate for 
the correlated channel is lower than that for the the uncorrelated channel when Eve 
inputs equivalent variance of the modes into the two channels. In addition, the properly 
added noise is beneficial for enhancing the secret key rate and the tolerable excess noise 
of the two-way CV QKD. The optimal tolerable excess noise of the two-way CV QKD 
with added noise is much more than that of the one-way CV QKD. With the reasonable 
reconciliation efficiency of 90%, the two-way CV QKD with added noise allows the 
distribution of secret keys over 60 km fibre distance, which is difficult to reach for the 
one-way CV-QKD protocols with Gaussian modulation in experiment. 
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Appendix A. The calculation of eigenvalues 



We use c^' mn to denote the elements of the corresponding covariance matrix T n of a 
n-mode state. The symplectic invariants { A n j} of T n for j = 1, n are defined as [10] 

A nj = M 2j (QT n ), (A.l) 

where Q = @™io- y (a y standing for the y Pauli matrix) and M 2 j(flT) is the principal 
minor of order 2j of the 2n x 2n matrix QT which is the sum of the determinants of all 
the 2j x 2j submatrices of QT n [H E] . 

The symplectic eigenvalues of the matrix corresponding to a four-mode state are 
the solution of the four-order equation on the symplectic invariants P, [291 SO] 

/a'/, 2 (0=— VC+e ± ^/2C-e ^_ , 



4 («L> 



2 v ' 2 



+ 



2C-e+ 



Hi 



-4A 4 iA 42 +8A 43 



4v^+e 



(A.2) 



where 



c 



Hi 



2A 



12 



e 



2a# 



J 



3-2*' 



J= L + VL 2 - 4F 3 



M,2 ~~ 3A4 j iA4 ) 3+12A4 j 4, 

L=2A^ 2 -9A4,iA4,2A4,3+27A^3+27A^ 1 A4,4-72A4,2A 4 ,4 • (A.3) 
From equation (EJ), the covariance matrix r^A^-Bi^A! of the modes 
N1N2B2B1A2A1 can be obtained by permuting the corresponding elements of 
Fb 2 b 1 n 2 n 1 a 2 a 1 - Applying a unitary transformation S — I © IYjy © I © I © I to equation 
(121), we can obtain 
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and 7^ 2 = [ib 2 ~ (1 — T n )V^]/T n , C[ = Gijy/T^ for i = 1,4, 5. Therefore, the eigenvalues 
of T B2BiN2Ni a 2Ai are A, = / Al 2 3 4 (a mn ), 1, 1, where /a 1ASi4 (a mn ) are the eigenvalues of 
T B ' 2 b 1 a 2 a 1 given by equation (|AT2|) . 

The symplectic invariants of ^ ^ A A are denote as A^j for j = 1...5. It can 
be proved that 1— A^i+ A52 — A53 + A54 — A§g= 0. Therefore, one of the eigenvalues of 
^b^AiA 2 b 2 N2Ni * s ^ anc ^ ^he others have the same forms of equation (IA.2j) . which needs 
the replacement A^A^i-l, A 42 =A 5t 2- A51+I, A 43 =A 5s4 - A55, A 44 =A 5t5 . 
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